@verne-build/cli@0.0.35: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@verne-build/cli@0.0.35: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

21 flagged · loading source

dist/NodeServices-Bqkx8Bg9.mjsView file

5import { createRequire } from "node:module"; L6: import * as NodeChildProcess from "node:child_process"; L7: import { PassThrough } from "node:stream";

High

Child Process

Package source references child process execution.

dist/NodeServices-Bqkx8Bg9.mjsView on unpkg · L5

5Cross-file remote execution chain: dist/NodeServices-Bqkx8Bg9.mjs spawns dist/Schema-BvfDeHKs.mjs; helper contains network access plus dynamic code execution. L5: import { createRequire } from "node:module"; L6: import * as NodeChildProcess from "node:child_process"; L7: import { PassThrough } from "node:stream"; ... L76: * operating-system processes. A spawner turns a command description into a L77: * handle that can write to stdin, read stdout and stderr, wait for exit, kill L78: * the process, and manage whether the process keeps its parent alive. Platform ... L433: return callback(function loop(resume) { L434: for (; i < chunk.length;) if (!options.writable.write(chunk[i++], options.encoding)) { L435: options.writable.once("drain", () => loop(resume)); ... L675: return options.extendEn

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/NodeServices-Bqkx8Bg9.mjsView on unpkg · L5

•matchType = normalized_sha256 matchedPackage = @dmccore/code@0.0.33-synaptic.10 matchedPath = dist/NodeServices-Ca--v9Zz.mjs matchedIdentity = npm:QGRtY2NvcmUvY29kZQ:0.0.33-synaptic.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/NodeServices-Bqkx8Bg9.mjsView on unpkg

dist/bin.mjsView file

3import { _ as __commonJSMin, a as isQuitError, b as __toESM, c as layer$97, d as pipeThroughDuplex, f as toArrayBuffer, g as ChildProcessSpawner, h as make$142, i as Terminal$1, l ... L4: import { $ as decode$5, $a as spaced, $c as isFinite$1, $i as runForkWith, $l as Service$3, $n as nowUnsafe, $o as fail$4, $r as flatMap$1, $s as CurrentLoggers$1, $t as toRepresen... L5: import { $ as runDrain, $t as offerAll, A as fromPull$1, B as mapError$1, C as flatMap$3, D as fromEffect, Dt as drain$1, F as isStream, G as onExit$1, Gt as collect, H as mkString... ... L9: import { createRequire } from "node:module"; L10: import * as NodeChildProcess from "node:child_process"; L11: import { Duplex, Readable } from "node:stream"; ... L20: import { cwd } from "process"; L21: import * as NodeNet from

Critical

Sensitive Archive Exfiltration

Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.

dist/bin.mjsView on unpkg · L3

3import { _ as __commonJSMin, a as isQuitError, b as __toESM, c as layer$97, d as pipeThroughDuplex, f as toArrayBuffer, g as ChildProcessSpawner, h as make$142, i as Terminal$1, l ... L4: import { $ as decode$5, $a as spaced, $c as isFinite$1, $i as runForkWith, $l as Service$3, $n as nowUnsafe, $o as fail$4, $r as flatMap$1, $s as CurrentLoggers$1, $t as toRepresen... L5: import { $ as runDrain, $t as offerAll, A as fromPull$1, B as mapError$1, C as flatMap$3, D as fromEffect, Dt as drain$1, F as isStream, G as onExit$1, Gt as collect, H as mkString... ... L9: import { createRequire } from "node:module"; L10: import * as NodeChildProcess from "node:child_process"; L11: import { Duplex, Readable } from "node:stream"; ... L20: import { cwd } from "process"; L21: import * as NodeNet from

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/bin.mjsView on unpkg · L3

dist/resource-monitor/darwin-x64/t3-resource-monitorView file

•path = dist/resource-monitor/darwin-x64/t3-resource-monitor kind = native_binary sizeBytes = 563048 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/resource-monitor/darwin-x64/t3-resource-monitorView on unpkg

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView file

•path = dist/client/assets/ghostty-vt-DdA0Zryv.wasm kind = wasm_module sizeBytes = 630932 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView on unpkg

dist/NodePtyAdapter-gDftfLbP.mjsView file

•matchType = normalized_sha256 matchedPackage = @dmccore/code@0.0.33-synaptic.10 matchedPath = dist/NodePtyAdapter-Bww4kU4T.mjs matchedIdentity = npm:QGRtY2NvcmUvY29kZQ:0.0.33-synaptic.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/NodePtyAdapter-gDftfLbP.mjsView on unpkg

dist/BunPtyAdapter-VCmyFG3E.mjsView file

•matchType = normalized_sha256 matchedPackage = @dmccore/code@0.0.33-synaptic.10 matchedPath = dist/BunPtyAdapter-CUYfkmpJ.mjs matchedIdentity = npm:QGRtY2NvcmUvY29kZQ:0.0.33-synaptic.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/BunPtyAdapter-VCmyFG3E.mjsView on unpkg

Source & flagged code

21 flagged

dist/NodeServices-Bqkx8Bg9.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2

3import { $l as Service, $r as flatMap, Ad as pipe, Dd as dual, Di as map, Ds as done, Er as asVoid, Ji as raceFirst, Lr as catch_, Mo as succeed$3, Or as callback, Os as fail$2, Ou as match, Pi as matchEffect, Qi as runFork, Qo as doneUnsafe, Ro as addFinalizer, Rr as clockWith, Rt as tag, Sa as try_, So as effect, Ta as uninterruptible, Vi as orDie, Vu as Prototype, Wr as effectify, Xl as succeed, Xo as _await, Zu as BaseProto, _r as addFinalizer$1, _s as succeed$2, _u as fromNullishOr, ai as forever, ao as isDoneCause, ba as timeoutOrElse, ci as forkIn, d as ErrorClass, dd as hasProperty, ds ...

4import { At as isSink, Cn as badArgument, Dt as drain, E as fromChannel$1, F as isStream, H as mkString, It as fromTransform, J as pipeThroughChannelOrFail, Lt as mapDone, Q as runCollect, Qt as offer, V as merge, Xt as failCauseUnsafe, Z as run, Zt as make$10, _ as empty, _t as

5import { createRequire } from "node:module";

6import * as NodeChildProcess from "node:child_process";

7import { PassThrough } from "node:stream";

High

Child Process

Package source references child process execution.

dist/NodeServices-Bqkx8Bg9.mjsView on unpkg · L5

8import * as NodeCrypto from "node:crypto";

9import * as NFS from "node:fs";

10import * as OS from "node:os";

11import * as Path from "node:path";

12import * as NodeUrl from "node:url";

13import * as readline from "node:readline";

14//#region \0rolldown/runtime.js

15var __create = Object.create;

16var __defProp = Object.defineProperty;

17var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

18var __getOwnPropNames = Object.getOwnPropertyNames;

19var __getProtoOf = Object.getPrototypeOf;

20var __hasOwnProp = Object.prototype.hasOwnProperty;

21var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);

22var __exportAll = (all, no_symbols) => {

23 let target = {};

24 for (var name in all) __defProp(target, name, {

25 get: all[name],

Long lines were clipped for display.

5Cross-file remote execution chain: dist/NodeServices-Bqkx8Bg9.mjs spawns dist/Schema-BvfDeHKs.mjs; helper contains network access plus dynamic code execution. L5: import { createRequire } from "node:module"; L6: import * as NodeChildProcess from "node:child_process"; L7: import { PassThrough } from "node:stream"; ... L76: * operating-system processes. A spawner turns a command description into a L77: * handle that can write to stdin, read stdout and stderr, wait for exit, kill L78: * the process, and manage whether the process keeps its parent alive. Platform ... L433: return callback(function loop(resume) { L434: for (; i < chunk.length;) if (!options.writable.write(chunk[i++], options.encoding)) { L435: options.writable.once("drain", () => loop(resume)); ... L675: return options.extendEn

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/NodeServices-Bqkx8Bg9.mjsView on unpkg · L5

•matchType = normalized_sha256 matchedPackage = @dmccore/code@0.0.33-synaptic.10 matchedPath = dist/NodeServices-Ca--v9Zz.mjs matchedIdentity = npm:QGRtY2NvcmUvY29kZQ:0.0.33-synaptic.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/NodeServices-Bqkx8Bg9.mjsView on unpkg

dist/bin.mjsView file

3import { _ as __commonJSMin, a as isQuitError, b as __toESM, c as layer$97, d as pipeThroughDuplex, f as toArrayBuffer, g as ChildProcessSpawner, h as make$142, i as Terminal$1, l ... L4: import { $ as decode$5, $a as spaced, $c as isFinite$1, $i as runForkWith, $l as Service$3, $n as nowUnsafe, $o as fail$4, $r as flatMap$1, $s as CurrentLoggers$1, $t as toRepresen... L5: import { $ as runDrain, $t as offerAll, A as fromPull$1, B as mapError$1, C as flatMap$3, D as fromEffect, Dt as drain$1, F as isStream, G as onExit$1, Gt as collect, H as mkString... ... L9: import { createRequire } from "node:module"; L10: import * as NodeChildProcess from "node:child_process"; L11: import { Duplex, Readable } from "node:stream"; ... L20: import { cwd } from "process"; L21: import * as NodeNet from

Critical

Sensitive Archive Exfiltration

Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.

dist/bin.mjsView on unpkg · L3

3import { _ as __commonJSMin, a as isQuitError, b as __toESM, c as layer$97, d as pipeThroughDuplex, f as toArrayBuffer, g as ChildProcessSpawner, h as make$142, i as Terminal$1, l ... L4: import { $ as decode$5, $a as spaced, $c as isFinite$1, $i as runForkWith, $l as Service$3, $n as nowUnsafe, $o as fail$4, $r as flatMap$1, $s as CurrentLoggers$1, $t as toRepresen... L5: import { $ as runDrain, $t as offerAll, A as fromPull$1, B as mapError$1, C as flatMap$3, D as fromEffect, Dt as drain$1, F as isStream, G as onExit$1, Gt as collect, H as mkString... ... L9: import { createRequire } from "node:module"; L10: import * as NodeChildProcess from "node:child_process"; L11: import { Duplex, Readable } from "node:stream"; ... L20: import { cwd } from "process"; L21: import * as NodeNet from

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/bin.mjsView on unpkg · L3

dist/resource-monitor/darwin-x64/t3-resource-monitorView file

•path = dist/resource-monitor/darwin-x64/t3-resource-monitor kind = native_binary sizeBytes = 563048 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/resource-monitor/darwin-x64/t3-resource-monitorView on unpkg

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView file

•path = dist/client/assets/ghostty-vt-DdA0Zryv.wasm kind = wasm_module sizeBytes = 630932 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView on unpkg

dist/NodePtyAdapter-gDftfLbP.mjsView file

•matchType = normalized_sha256 matchedPackage = @dmccore/code@0.0.33-synaptic.10 matchedPath = dist/NodePtyAdapter-Bww4kU4T.mjs matchedIdentity = npm:QGRtY2NvcmUvY29kZQ:0.0.33-synaptic.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/NodePtyAdapter-gDftfLbP.mjsView on unpkg

dist/BunPtyAdapter-VCmyFG3E.mjsView file

•matchType = normalized_sha256 matchedPackage = @dmccore/code@0.0.33-synaptic.10 matchedPath = dist/BunPtyAdapter-CUYfkmpJ.mjs matchedIdentity = npm:QGRtY2NvcmUvY29kZQ:0.0.33-synaptic.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/BunPtyAdapter-VCmyFG3E.mjsView on unpkg